Lessons from a decade of building whistleblower tech

The talk opens with the 2012 episode in which a source struggled to reach a journalist over PGP, a story that led to the Snowden disclosures. It then describes the wider problem: journalists lost their legal shield as governments obtained metadata from tech companies, and sources are often exposed by who they contacted rather than by what they said. SecureDrop grew from Aaron Swartz's unfinished prototype into a platform now used by dozens of major news outlets.

The middle of the talk covers the design lessons the team learned. Newsrooms self-host the system on their own servers, and sources connect through Tor onion services. Because sources often need long conversations, the system uses random passphrases instead of accounts with recovery. Spam and malware are handled by moving document review from a manual air-gapped workflow into Qubes, where each file is opened in a disposable, isolated virtual machine. The speakers explain why end-to-end encryption in a web browser is hard, since a compromised server can serve malicious code, and they describe a protocol designed with ETH Zurich researchers.

The talk closes with WEBCAT, a manifest-and-transparency approach to verifying web code before it runs. It is currently a browser extension and is being bundled into Tor Browser. The takeaway for practitioners is to model the threat carefully, and to treat browser code integrity as a real gap for any anonymous or end-to-end encrypted web tool.